Privacy Policy
Effective 17 October 2026
This is an English translation of our 개인정보처리방침. If it differs from the Korean version, the Korean version applies.
AcquiLAB Inc. (주식회사 아퀼랩, "we") processes the personal information of people who use AcquiLAB as described below, in line with the Korean Personal Information Protection Act and other applicable laws.
1. Why we process personal information
We process personal information only for the purposes below. If a purpose changes, we tell you first and ask for any consent needed.
- creating your account, confirming your identity, signing in and keeping your account secure (two-step verification, passkeys, abuse prevention);
- providing the Service: data analysis, graphs and figures, simulation, optimization, the AI Assistant, documents, workspace sharing and invitations;
- payments, refunds and credits for Paid Services (when payments are offered);
- answering your questions and sending service notices such as changes to our terms and policies;
- meeting legal obligations and handling disputes.
We do not use your personal information for advertising, sell it, profile you for targeted advertising, or use it to train AI models.
2. What we collect and how
| Category | Items | How |
|---|---|---|
| Sign-up (required) | Email address, name (first, last, display name), affiliation, organization type, country, position | Sign-up form or sign-in provider such as Google |
| Sign-in (required) | Password (one-way hashed), sign-in provider account identifier, passkey public keys, two-step verification data (encrypted) | Sign-up and Settings |
| Researcher identity (optional) | ORCID iD and name | When you connect ORCID |
| Usage records | Sign-in times, a hash of your IP address, browser information, security events, audit records of important actions | Created automatically as you use the Service |
| Content | Files, data, analysis results, campaigns, figures, documents and Assistant conversations you upload or create | Your input |
| Payments (Paid Services) | Plan, payment and refund records, billing details (name or organization, email, country, tax ID) | Checkout and payment providers |
| Support | Name, email, your message and, if you agree, the page you were on and your browser | Settings → Support |
Card numbers and other payment details are handled by the payment providers; we do not store them. We do not collect resident registration numbers or sensitive information. If data you upload contains other people's personal information, you are responsible for having a lawful basis for it.
3. How long we keep it
We keep your personal information until you close your account. When you ask to delete your account, we wait 30 days (you can sign in and cancel during that time) and then erase it without delay: your email, name, profile, sign-in methods and the content and files of the workspaces you own are deleted, and records that stay in workspaces shared with others are made anonymous.
The following are kept for the periods the law requires and then destroyed:
| Record | Law | Period |
|---|---|---|
| Contracts and withdrawals | Act on Consumer Protection in Electronic Commerce | 5 years |
| Payments and supply of services | Act on Consumer Protection in Electronic Commerce | 5 years |
| Consumer complaints and disputes | Act on Consumer Protection in Electronic Commerce | 3 years |
| Access logs (sign-in records) | Protection of Communications Secrets Act | 3 months |
Electronic files are deleted so they cannot be recovered. Copies in backups disappear when the backup cycle ends (at most 30 days).
4. Sharing with third parties
We do not give your personal information to third parties unless you consent or the law specifically requires it. When you invite someone to a workspace or accept an invitation, the workspace owner can see its members' names and email addresses.
5. Service providers (processors)
We use the providers below to run the Service. Our contracts with them include the protections the law requires, and we supervise them.
| Provider | What they do |
|---|---|
| Google LLC (Google Cloud) | Servers, database and file storage (Seoul region, Korea) |
| Cloudflare, Inc. | Website delivery, security (DDoS protection), administrator access control |
| OpenAI, L.L.C. | Generating AI Assistant answers |
| Anthropic, PBC | Generating AI Assistant answers |
| Resend, Inc. | Service emails such as sign-up confirmation, password reset and invitations |
| Paddle.com Market Limited | International payments and receipts (when Paid Services are offered) |
| Toss Payments Co., Ltd. | Payments in Korea (when Paid Services are offered) |
If providers or their tasks change, we update this policy.
6. Transfers outside Korea
To provide the Service (performing our contract with you), we transfer personal information abroad as below, disclosed here under Article 28-8(1)(3) of the Personal Information Protection Act. Transfers happen whenever you use the relevant feature, over encrypted connections (HTTPS).
| Recipient (contact) | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| OpenAI, L.L.C. (openai.com/policies) | United States | Your questions and conversation with the Assistant, and the project information it needs (data summaries, analysis results) | Generating AI Assistant answers | Kept up to 30 days for abuse monitoring under OpenAI's policy, then deleted; not used for training |
| Anthropic, PBC (anthropic.com/legal/privacy) | United States | Your questions and conversation with the Assistant, and the project information it needs (data summaries, analysis results) | Generating AI Assistant answers | Kept up to 30 days under Anthropic's policy, then deleted (content flagged for a usage-policy review may be kept longer); not used for training |
| Cloudflare, Inc. (cloudflare.com/privacypolicy) | United States and other countries of its network | IP address, request information (access records) | Website delivery and security | While the request is handled (security logs per Cloudflare's policy) |
| Resend, Inc. (resend.com/legal/privacy-policy) | United States | Email address, name, email content | Sending service emails | Delivery records per Resend's policy |
| Paddle.com Market Limited (paddle.com/legal/privacy) | United Kingdom | Email, name or organization, country, payment information | International payments and receipts (when offered) | As required by law |
You can refuse these transfers. If you do not want your information sent to the AI model provider, do not use the Assistant; everything else keeps working. Website delivery and service emails are needed to provide the Service, so refusing them means closing your account.
7. Your rights
You can ask at any time to see, correct or delete your personal information, to stop processing it, or to withdraw your consent.
- Check and edit your profile in Settings.
- Under Settings → Your data you can download everything we hold about you as one file (JSON) or ask to delete your account.
- For anything else, write to privacy@acquilab.io. We act within 10 days of receiving your request and tell you the result.
You may also act through a legal representative or someone you authorise, who must provide a power of attorney. Deletion may be limited where the law requires us to keep information.
8. Children
Only people aged 16 or older can sign up, and we do not collect personal information from children under 14. If we learn that we have, we delete it at once.
9. How we protect personal information
- Organisational: a named privacy officer, least-privilege access, audit records of administrative actions.
- Technical: encryption in transit (HTTPS), one-way hashed passwords, encrypted two-step verification data, authorization checks on every request, limits on sign-in attempts, extra verification for administrators.
- When we check whether a password has appeared in a known breach, only the first 5 characters of its hash leave our servers; the password itself never does.
- Physical: data is stored in Google Cloud's secure data centres and encrypted at rest.
11. The AI Assistant and automated processing
The AI Assistant uses generative AI (an OpenAI or Anthropic model), and its answers are labelled as AI-generated. It works only when you ask it to and reads only information in projects you have access to.
We make no fully automated decisions that have legal or similarly significant effects on you. Optimization suggestions are proposals about experimental conditions, not decisions about people.
12. Privacy officer
For questions, complaints or remedies about how we handle personal information, contact:
- Privacy officer: SHARIPOV MIRKOMIL ALISHEROVICH (Representative Director)
- Email: privacy@acquilab.io
13. Where else you can get help
You can also contact these Korean public bodies:
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
If you live in another country, you may also contact your local data protection authority.
14. Changes to this policy
We announce changes in the Service at least 7 days before they apply; changes that materially affect your rights are announced 30 days in advance and emailed to you.
This policy applies from 30 September 2026.
15. Who is responsible
AcquiLAB Inc. (주식회사 아퀼랩) · Representative Director SHARIPOV MIRKOMIL ALISHEROVICH · Business registration number 633-87-03832 · Room 404, Ace Gold Tower, 100 Gasan digital 1-ro, Geumcheon-gu, Seoul, Republic of Korea · privacy@acquilab.io